Build binaries for each release

[bajtos]

At the moment, we tell module builders to install Zinnia using cargo install. This requires Rust tooling, and the build takes a long time.

Let's implement a GitHub Actions workflow to build binaries for the common platforms and attach them to GitHub Releases.

We can draw inspiration from git-delta, Starship or other CLI tools written in Rust.

Nice to have, but most likely out of scope: package Zinnia for Homebrew, winget or Chocolatey, and Linux package managers (apt-get, rpm).

Tasks

• Setup Release CD pipeline - ci: add release workflow #80
• Add Apple Silicon support - feat: support Apple Silicon (M1/M2) #82
• Sign macOS binaries. Use the following App ID: app.filstation.zinnia. - feat: sign macOS binaries #91
• Notarise macOS binaries. - feat: notarize macOS binaries #161
• Modify the CD workflow to create a draft GH Release and attach the binaries to this draft
  feat: sign macOS binaries #91
• Update the docs - CLI Installation
  docs: install prebuilt binaries #162

Out of scope

• Windows support - moved to Support Windows #99

Notes

• Can we use cargo-dist? https://blog.axo.dev/2023/02/cargo-dist
• Starship workflow: https://github.com/starship/starship/blob/master/.github/workflows/release.yml
• git-delta workflow: https://github.com/dandavison/delta/blob/master/.github/workflows/cd.yml
• RipGrep workflow: https://github.com/BurntSushi/ripgrep/blob/master/.github/workflows/release.yml
• https://github.com/burtonageo/cargo-bundle

Resources describing macOS notarisation:

• https://www.reddit.com/r/rust/comments/q8r90b/notarization_of_rust_binary_for_distribution_on/
• https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution
• https://github.com/rustymagnet3000/notarize_a_cli_macos_app
• https://github.com/electron/notarize
• https://github.com/marketplace/actions/xcode-staple
• https://github.com/BoundfoxStudios/community-project/blob/develop/.github/workflows/notarization.yml
• https://github.com/BoundfoxStudios/action-xcode-notarize
• https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow#3087734

[bajtos]

We are not able to build release binaries on Windows:

https://github.com/filecoin-station/zinnia/actions/runs/4342544771/jobs/7583484387

2023-03-06T11:02:48.5823750Z The unwind destination does not have an exception handling instruction!
2023-03-06T11:02:49.0286127Z   invoke fastcc void @"_ZN8smallvec17SmallVec$LT$A$GT$4push17h1519892d17bccc62E"(ptr noalias noundef nonnull align 8 dereferenceable(1320) %26, ptr noalias nocapture noundef nonnull dereferenceable(328) %10)
2023-03-06T11:02:49.0291050Z           to label %32 unwind label %172
2023-03-06T11:02:49.0291741Z CleanupReturnInst must unwind to an EH block which is not a landingpad.
2023-03-06T11:02:49.0323813Z   cleanupret from %47 unwind label %172
2023-03-06T11:02:49.0325794Z The unwind destination does not have an exception handling instruction!
2023-03-06T11:02:49.0359390Z   invoke void %95(ptr noundef align 1 %81, ptr noalias noundef nonnull readonly align 8 dereferenceable(128) %3)
2023-03-06T11:02:49.0363623Z           to label %96 unwind label %172
2023-03-06T11:02:49.0364401Z The unwind destination does not have an exception handling instruction!
2023-03-06T11:02:49.0377807Z   invoke fastcc void @"_ZN8smallvec17SmallVec$LT$A$GT$4push17h1519892d17bccc62E"(ptr noalias noundef nonnull align 8 dereferenceable(1320) %99, ptr noalias nocapture noundef nonnull dereferenceable(328) %8)
2023-03-06T11:02:49.0378596Z           to label %105 unwind label %172
2023-03-06T11:02:49.0379228Z The unwind destination does not have an exception handling instruction!
2023-03-06T11:02:49.0391970Z   invoke fastcc void @"_ZN8smallvec17SmallVec$LT$A$GT$4push17h1519892d17bccc62E"(ptr noalias noundef nonnull align 8 dereferenceable(1320) %99, ptr noalias nocapture noundef nonnull dereferenceable(328) %7)
2023-03-06T11:02:49.0392834Z           to label %109 unwind label %172
2023-03-06T11:02:49.0393356Z The unwind destination does not have an exception handling instruction!
2023-03-06T11:02:49.0404804Z   invoke fastcc void @"_ZN8smallvec17SmallVec$LT$A$GT$4push17h1519892d17bccc62E"(ptr noalias noundef nonnull align 8 dereferenceable(1320) %143, ptr noalias nocapture noundef nonnull dereferenceable(328) %5)
2023-03-06T11:02:49.0405419Z           to label %149 unwind label %172
2023-03-06T11:02:49.0406002Z The unwind destination does not have an exception handling instruction!
2023-03-06T11:02:49.0416422Z   %156 = invoke fastcc noundef zeroext i1 @_ZN13futures_timer6native5delay5Delay6_reset17hc4965b87f426a0b4E(ptr noalias noundef nonnull align 8 dereferenceable(8) %151, i64 %153, i32 noundef %155)
2023-03-06T11:02:49.0417321Z           to label %157 unwind label %172
2023-03-06T11:02:49.0417834Z CleanupReturnInst must unwind to an EH block which is not a landingpad.
2023-03-06T11:02:49.0425836Z   cleanupret from %167 unwind label %172
2023-03-06T11:02:49.0429489Z CleanupPadInst not the first non-PHI instruction in the block.
2023-03-06T11:02:49.0831266Z   %175 = cleanuppad within none []
2023-03-06T11:02:49.0833253Z in function _ZN94_$LT$libp2p_identify..handler..Handler$u20$as$u20$libp2p_swarm..handler..ConnectionHandler$GT$19on_connection_event17h95a32c9225255a1cE
2023-03-06T11:02:49.0833964Z LLVM ERROR: Broken function found, compilation aborted!
2023-03-06T11:02:49.2688933Z �[0m�[0m�[1m�[31merror�[0m�[1m:�[0m could not compile `zinnia`

Related: rust-lang/rust#107781

[bajtos]

After disabling LTO on Windows, I am getting even more confusing error 😢

zinnia.zinnia.110ceaee-cgu.0.rcgu.o : error LNK2001: 
  unresolved external symbol _ZN87_$LT$deno_fetch..FetchRequestBodyResource$u20$as$u20$deno_core..resources..Resource$GT$5close17h997a6b0d3cc3fee5E

D:\a\zinnia\zinnia\target\x86_64-pc-windows-msvc\release\deps\libenv_logger-6ca55d1e16f40731.rlib : fatal error LNK1107:
   invalid or corrupt file: cannot read at 0x9AD38

error: could not compile `zinnia` due to previous error

[bajtos]

Resources for running Apple notarization via CLI:

• https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution/customizing_the_notarization_workflow
• https://scriptingosx.com/2021/07/notarize-a-command-line-tool-with-notarytool/
• altool deprecated and replaced by notarytool akeru-inc/xcnotary#22 (comment)
• Starship.rs
  • https://github.com/starship/starship/blob/55fa90c004afcdba33788d4d2ab94fa48f8bb35c/.github/workflows/release.yml#LL212C11-L212C27
  • codesign --timestamp --keychain "$keychain_path" --sign "$APPLICATION_KEY_IDENT" --verbose -f -o runtime "$starship_binary"
  • https://github.com/starship/starship/blob/55fa90c004afcdba33788d4d2ab94fa48f8bb35c/install/macos_packages/build_and_notarize.sh#L82
  • https://github.com/starship/starship/blob/55fa90c004afcdba33788d4d2ab94fa48f8bb35c/install/macos_packages/build_and_notarize.sh#L106

I think we will need to enable hardened runtime when signing the binary (codesign -o runtime) and maybe specify a list of entitlements - see Station Desktop entitlements

Quoting few more requirements from https://developer.apple.com/documentation/security/notarizing_macos_software_before_distribution

• Link against the macOS 10.9 or later SDK

[bajtos]

How to find the team-id value required by the notary tool:

❯ xcrun altool --list-providers -u your@apple-id

[bajtos]

Done 🥳